099650cd133fdeacda04a6d25298cb9a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

099650cd133fdeacda04a6d25298cb9a
Size

188KB
MD5

099650cd133fdeacda04a6d25298cb9a
SHA1

285e9174a6bf809d4b4919d024b2b2043c52d366
SHA256

47e481a50be1cf0937a2000b1171251c5e5bb34c0a0327e79f88af07d7e09f2c
SHA512

fa33cb2c910765a7ed1217325daf68a50a3b6706c79a03721900bcc79475871599be8db82945889b16377b7fc7a97eb377bccdaa75bb6eb83a9b4d84211a5bb1
SSDEEP

3072:94uB6e8xB/c+YvKWg+aQev2gujayP1Ep/eAAYCymnKDj:CuseY/cJ3g+LOOayPGp+lm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
099650cd133fdeacda04a6d25298cb9a

Files

099650cd133fdeacda04a6d25298cb9a
.dll windows:5 windows x86 arch:x86

094b06fb8a1e730ce67feae9850a5661

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExA
GetModuleFileNameA
FindActCtxSectionGuid
Sleep
GetModuleHandleW
GetGeoInfoW

msvcrt

strlen
memset

ntdsapi

DsBindWithCredW

mprapi

MprAdminMIBEntryGetNext

oleaut32

VarR8FromCy
VarDecFromR8

gdi32

CreateColorSpaceA

setupapi

SetupCloseInfFile

crypt32

CryptFreeOIDFunctionAddress

user32

ShowOwnedPopups
UnionRect

winmm

waveOutGetPitch

advapi32

RegLoadAppKeyA
RegisterServiceCtrlHandlerA

Exports

Exports

WeprmcFosller

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ